FS Linux 10 Installation Guide

Connect an active network cable to your lowest numbered interface (only). Usually it is on the left if there are two.

Insert/plug-in your installation media and reboot.

To boot of the installation media you may need to bring up your motherboards boot menu, which is typically accessed by pressing F11 or F12.

At the Installer boot menu:

The installer will now boot.

Find your keyboard on the keymap list and press Enter. (The most common one is American English)

The installation media is now scanned and additional installer components loaded.

You may need to locate the files requested (especially if they relate to your network or disk-drive interfaces) and place them on a USB stick which should be inserted at this stage. If you do have the required files select Yes, otherwise press Tab to select No then press Enter to continue. It may well be simpler just to use the unofficial installer images mentioned above that include all available non-free firmware.

Typically only shown if two or more network interfaces are found, which might include a virtual firewire interface in some cases. Select the interface you require (usually eno1) and press Enter.

Unless you are using DHCP (which is not advisable) you will be prompted to:

Alternatively, if you are only using the installer to initialize new disks, you may want to use Go Back and directly select Detect disks from the main menu to skip forward to Setup partitions below.

Backspace over the default hostname debian and type in the name you require (if not already retrieved via DNS), then press Enter. Enter the required Internet Domain name (if not found) and press Enter.

Twice as prompted.

Enter Desktop User for the name of the new user then press Enter to accept desktop as the username and enter a (real) password twice as prompted.

The installer now tries to set the time using NTP If this is not possible at your site due to your firewall etc., you may need to press Enter to cancel this process.

When prompted, select Manual

If you start from a netinst CD image, the installer now assumes you will install only from the network, and jumps straight to the Choose your country…​ part of the dialogue as detailed below.

Select the fastest Debian mirror from those available.

Enter any necessary HTTP proxy information (usually left blank.)

If you are using DVD installer you will be prompted to scan additional DVDs. Scanning the additional DVDs (and obtaining copies of them in the first place) is entirely optional, and is only useful if you don’t have a reliable network connection to a suitable Debian mirror and hence would prefer not to download packages you could get from the DVD.

For each additional DVD you wish to scan, insert it in the drive, select Yes and press Enter to perform the scan (which takes a while.)

(If you are using DVDs, and are prompted to insert another DVD, you will need to use eject /dev/cdrom from another virtual console to do this)

Select No and press Enter to continue once you are done. If prompted, insert the “Debian GNU/Linux 9.<x> Stretch - Official i386/amd64 Binary-1 DVD” back into the DVD-ROM drive and press Enter.

Select Yes and press Enter to use a network mirror (unless you have inadequate Internet access - but then you must scan all DVDs.) Choose your country from the list if available and press Enter. (If your country is not available choose the country nearest to you in a network connectivity sense.)

When prompted to join the popularity-contest, select No and press Enter

When prompted to choose packages, select SSH server by highlighting it with the arrow keys and pressing Space on it (unless you don’t want it).

Finally press, Enter to install the standard system.

The Debian standard system is now installed from the installation media plus any updates from the network mirror and/or security.debian.org site if they can be reached.

This can take a while, up to one and a half hours or more.

At Install GRUB to Master Boot Record select yes then select /dev/sda

When prompted, press Enter to install to the master boot record of the primary disk.

Remove the DVD from the DVD-ROM drive (it should be auto-ejected), or unplug the USB drive and press Enter to reboot into the newly installed system.

Switch to Virtual Console 2, by pressing Ctrl+Alt+F2.

Enter root and press Enter, then enter the root password you set earlier.

Unless you want another account that that is set up to use the default desktop environment, delete desktop with:

Should you wish to make APT use an HTTP proxy for downloads, create the new file /etc/apt/apt.conf.d/00proxies using vi containing:

to use a proxy proxy.some.where at port 8080 for example.

Using your favourite text editor, eg vi, and comment out all cdrom entries (unless you don’t have a decent Internet connection and need to use DVDs, whereupon the dialogue presented below may differ) and check you have the equivalent of the following entries towards the top of the file, adding in contrib and/or non-free as needed:

and likewise the equivalent of the following entries towards the bottom of the file, again adding in contrib and/or non-free as needed:

(where you can use any suitable mirror instead of deb.debian.org)

Also add contrib and/or non-free to the lines referring to the security.debian.org mirror in the middle of the file.

Next tell APT to update its internal source list of packages using

Downloading commences for up to half an hour (depending on your Internet access and the exact revision of DVDs used).

Installation runs to completion.

So that the update mechanism will work correctly, run

In the /root/fsl10 directory, start fsadapt with

Set passwords for the oper and prog accounts with:

entering the passwords twice as prompted.

You can install some useful tools for working with the RAID, if you’re actually using it, with:

The rest of this document assumes the first three of these tools have been installed. The five tools are:

See also the Setup additional disk sub-section in the Post Install section below.

where tag is the latest available release, be it 10.0.0 or later.

This will set the /usr2/fs link, set /usr2/fs-git permissions, and install default copies of all the FS related directories.

and enter y to confirm installation.

The FS must always be compiled as prog.

then

to confirm that everything compiled correctly (no news is good news).

If you installed the RAID with two disks (and RAID tools) check its progress with:

until the array no-longer shows a recovery in progress.

The final steps are to remove any DVD from the machine and to restart the machine using reboot as root or Ctrl+Alt+Del whilst watching that everything starts up smoothly.

Your new FS machine should now be ready to be customised to your requirements by tailoring the control files in /usr2/control and adding suitable station specific software to /usr2/st. See the files in the /usr2/fs/misc directory for more information.

Ensure the RAID is synced by checking that

shows no recovery in progress. If there is none, shut down the machine safely. If you installed with a second disk, remove it and place it on the shelf.

Please refer to the appendix Additional Setup Items below for customizations that your system may need or that you may find useful.

For stations that wish to conform to the additional security recommendations of the Center for Internet Security (CIS), move on to the CIS hardening FSL10 document.

There are a few changes you should consider for root's .bashrc file.

This sub-section requires using nm-connection-editor on a graphic display (nmtui may be an option on a text terminal, but it has not been fully verified). You will probably need to be root or desktop to do this. When you run this program and select a connection, e.g., Wired connection 1 under Ethernet, the Edit button should become active. If it stays greyed out, you don’t have sufficent permission. All the sub-sections below assume you are in program and have sufficent permision,

If you do not need the functionality available in the Desktop environment, you can disable the desktop account. You can re-enable the account later if you need it. To disable it, execute:

You can undo this by using the -U option instead.

To prevent connecting with ssh using a key, create (or add desktop to an existing) DenyUsers line in /etc/ssh/sshd_config:

And restart sshd with:

You can undo the ssh block be removing the line (if it only has desktop) or removing desktop from the line and then restarting sshd.

If you use serial ports, it is strongly advised that you remove the ModemManager package to avoid conflicts over access to the ports. Execute this command:

If you enabled the weekly update job in fsadapt (it is strongly recommended), we recommend that you also remove the anacron package so that the job will run at a fixed time every week, even if the system is turned off for some periods of time. Execute this command:

The following tersely summarizes some ufw settings that may be useful:

The configuration described here (Internet site or mail sent by smarthost in the exim4 configuration, no incoming mail, reply-to-filter, and modified user names), provides good support of the FS msg and rdbemsg utilities.

If mail from your system is being rejected by some servers because exim4 is not providing a Fully Qualified Domain Name (FQDN), in its HELO message, the following solution should fix the problem.

Add the following line to the beginning of /etc/exim4/exim4.conf.template:

Then execute:

If your display sometimes starts with the wrong resolution, you may be able to configure a better resolution. The following is a description of something that worked for at least one system. The details of your system may require some changes (beyond the resolution and output name).

First you need to determine the correct resolution and output name. You may be able to do this with xrandr. If the screen currently has the correct resolution, you can just execute:

The output might look like:

Where the current screen resolution is 1920x1200 and the output name is VGA-1.

You can then generate the needed Modeline by executing:

Which might generate output:

As a test, you can make a script (use an appropriate name), that will enable that resolution. Use the output name (VGA-1 in this example) and the tokens following Modeline from above. There are three lines after the #!/bin/bash line.

Be sure to chmod u+x the file before executing.

If that is successful, you can use output name (VGA-1 in this example) and Modeline from above to make a file (you may need to create the directory first):

You should chmod the permissions for directory with o+rx and the file with o+r, if those are not already set.

You could then try restarting the display (after closing all windows) with:

or rebooting.

TODO: Still slow for some cases (exact ones still not clear)

If you have chosen to disable Wayland for gdm3 and have a problem with slow reboots/shutdowns, the following may help.

If there is a VLAN firewall in use on the local network, it may be necessary to use KeepAlive for TCP connections to prevent inactivity time-outs for network connections from the FS to the VLBI equipment when no activity is occurring with the system. For some devices, having the time-out break the connection may cause an issue with the number of connections available.

To use KeepAlive to prevent the inactivity time-outs, first install the package libkeepalive0:

Then add the follow lines for oper (and prog):

Then add the following alias for oper (and prog):

You will need to terminate the FS, log out, and log back in to activate these changes.

A similar alias can used to allow other individual applications to avoid the inactivity time-outs. (A better solution is available for ssh, discussed below.) It is also possible to put export LD_PRELOAD=libkeepalive.so in ~/.profile to enable it for all applications, but this may generate some error messages (in the case of xterm at least, the error is apparently benign).

If you need to have a persistent ssh connection, add the follow for oper (and prog):

This can be set selectively per remote system. The interval of 200 seconds is chosen to be less than the 300 seconds that some (possibly security hardened) servers may use.

If not already set correctly, set the ~/.ssh/config file’s permissions and ownership for oper (analogously for prog) with:

If you use ssh as oper (and maybe prog), to run commands on other systems as part of FS operations, you may get login banners mixed in with the output. You can suppress the banners by adding the following for oper (and analogously for prog):

This will allow errors to be displayed while suppressing the login banners of remote systems. This can be set selectively per remote system.

Please check the end of the Use KeepAlive to prevent VLAN firewall inactivity time-out section for setting the ownership and permissions on ~/.ssh/config.

For good performance with NTP, please follow the recommendations in /usr2/fs/misc/ntp.txt.

Additionally, to make the ntpq -c pe output more readable for local devices, you can adjust the contents of /etc/hosts. The local devices should be listed in the file, but use a nickname (15 characters or less) that is meaningful locally in place of the canonical name (the first name after the IP address). The canonical name can be listed after the nickname.

If your system is using a RAID configuration, you may want to install the raid-events script. The script provides email notifications of when Rebuilds (and array checks) start and end. For full details on the script and installation instructions, please see the raid-events sub-section in the Script descriptions section of the RAID Notes for FSL 10 document.

If you are using two systems, an operational and a spare, you may want to install the refresh_spare_usr2 script. The script can be used to backup the /usr2 partition on the operational system to the spare system. For full details on the script and installation instructions, please see the refresh_spare_usr2 sub-section in the Script descriptions section of the RAID Notes for FSL 10 document.

If updates are needed, the weekly cron job will send a message to root (or whoever e-mail to root is aliased to, typically oper) with instructions on how to install the updates. You can choose a convenient time, when not in (or about to start) operations, to install the updates and test the system.

The commands for installing the updates given by the message are (note the use of apt instead of apt-get):

Enter y to confirm as needed. Then

If the weekly cron job was installed according to the fsadapt section above (for Window 2), the first of these commands (with upgrade) will show if any NEWS items are included in the update. If there are, they will be displayed by a paging program at the beginning of the upgrade and you will be given an extra chance to abort before installing.

If there is a kernel update available, the weekly cron job output will include a warning at the end with additional instructions depending on which type is available. There are two types of kernel updates:

Be sure to allow time to follow the instructions when planning to install these updates. As described in the ABI update warning, you will need to rebuild any out-of-tree modules after rebooting for that case. This is discussed in the Updating out-of-tree modules sub-section below.

If an update fails, e.g., an updated kernel fails to boot or another problem is discovered, you can recover as described in FSL10 RAID document Recoverable testing section, if you were following that method, or from a shelf disk according to the FSL10 RAID document Recover from a shelf disk section if not and you have a good shelf disk.

If you do not use the weekly cron job to check for updates, or if you want to make sure you have the very latest updates when you install them, you can run the distributed copy of the weekly update script manually to check for updates:

If there is no output, there are no updates to install.

If there is output, there are updates to install. You can install them by following the installation procedure in sub-section Installing updates (Upgrading) above, except you will use the instructions from the output of the script above instead of from the weekly cron job (the outputs should be equivalent for the same set of updates). Additionally, please read the following NOTE.

Any NEWS items will be included in the script output along with the packages to be updated. If you would like to see any NEWS items more distinctly after the previous command and before installing the updates, you can run the script again using the --which=news option:

If there are updates available and no NEWS items, you will only get the installation instructions.

You can use this second form of running the script to check for updates initially, if you do not need to review which updates are available (you will still get warnings about kernel updates). As usual, you will see no output at all if there are no updates available.

When support for stretch ends, currently expected in June 2022, there will be no more security updates. At that time, the existing packages will be migrated to the Debian archive site. This will be visible in the output from the weekly cron job script as errors that the packages files can’t be found. Two steps are needed at that time: